Reviewed July 2026. This article was substantially updated to reflect current web standards and practices.
WordPress security is an ongoing operating process. A hardened login screen cannot compensate for unsupported software, abandoned plugins, weak hosting, or backups that have never been restored.
Keep every layer supported
Run a supported WordPress release and promptly update core, plugins, themes, PHP, and server packages. Remove inactive extensions you do not need. Use staging and a current backup for higher-risk updates.
Reduce access and attack surface
Give each person an individual account with the least privilege required. Use strong unique passwords, multi-factor authentication, secure administrative email, and limited administrator roles. Restrict file editing and unnecessary remote access where the hosting setup allows it.
Choose extensions carefully
Prefer actively maintained plugins and themes with a clear owner, recent compatible releases, and a focused purpose. Fewer high-quality extensions are easier to review and update than a large overlapping stack.
Prepare to recover
Store automated backups away from the web server, retain more than one restore point, and test restoration. Add uptime, integrity, error, and security monitoring so the team learns about a problem before customers do.
Use official maintenance guidance
WordPress recommends keeping core, plugins, and themes current and maintaining backups. Review the official update documentation as part of the site's maintenance plan.
Build a maintenance routine
Review available updates on a defined schedule and assign an owner for urgent advisories. Test significant changes on staging, verify forms and high-value journeys, then deploy with a rollback plan. Automatic updates can reduce exposure for selected components, but teams still need monitoring for failed updates and regressions.
Harden accounts and hosting
- Use individual accounts, least-privilege roles, strong unique passwords, and multi-factor authentication.
- Protect registrar, DNS, hosting, repository, backup, and email accounts as carefully as WordPress itself.
- Use supported PHP and database versions with secure file ownership and permissions.
- Disable or restrict unused remote services and administrative paths where appropriate.
- Use HTTPS everywhere and review security headers with the hosting architecture.
- Keep secrets out of repositories and public web directories.
Detect and recover
Monitor uptime, unexpected file changes, administrative logins, errors, and outbound email. Keep clean off-site backups with multiple retention points. A recovery plan should identify who can access the registrar and host, how to isolate the site, where clean code comes from, how credentials are rotated, and how customers are notified if required.
A security plugin can support parts of this program, but it cannot replace supported software, strong access control, secure hosting, and tested restoration. Review the complete system after staff, vendors, or infrastructure change.